16 Mai
2019
16 Mai
'19
18:49
apticron report [Thu, 16 May 2019 18:49:12 +0200]
========================================================================
apticron has detected that some packages need upgrading on:
nonagon.federez.net
[ 185.230.78.42 2a0c:700:0:23:67:e5ff:fee9:3 ]
The following packages are currently pending an upgrade:
bind9-host 1:9.10.3.dfsg.P4-12.3+deb9u5
dnsutils 1:9.10.3.dfsg.P4-12.3+deb9u5
host 1:9.10.3.dfsg.P4-12.3+deb9u5
libbind9-140 1:9.10.3.dfsg.P4-12.3+deb9u5
libdns162 1:9.10.3.dfsg.P4-12.3+deb9u5
libdns-export162 1:9.10.3.dfsg.P4-12.3+deb9u5
libisc160 1:9.10.3.dfsg.P4-12.3+deb9u5
libisccc140 1:9.10.3.dfsg.P4-12.3+deb9u5
libisccfg140 1:9.10.3.dfsg.P4-12.3+deb9u5
libisc-export160 1:9.10.3.dfsg.P4-12.3+deb9u5
liblwres141 1:9.10.3.dfsg.P4-12.3+deb9u5
linux-libc-dev 4.9.168-1+deb9u2
========================================================================
Package Details:
apt-listchanges : Lecture des fichiers de modifications (« changelog »)...
apt-listchanges : journaux des modifications (« changelogs »)
-------------------------------------------------------------
--- Modifications pour bind9 (bind9-host dnsutils host libbind9-140 libdns162
libdns-export162 libisc160 libisccc140 libisccfg140 libisc-export160 liblwres141) ---
bind9 (1:9.10.3.dfsg.P4-12.3+deb9u5) stretch-security; urgency=high
[ Marc Deslauriers (Ubuntu) ]
* CVE-2018-5743: limiting simultaneous TCP clients is ineffective.
Thanks to Marc Deslauriers of Ubuntu (Closes: #927932)
[ Ondřej Surý ]
* Sync Maintainer and Uploaders with unstable
* [CVE-2019-6465]: Zone transfer for DLZs are executed though not
permitted by ACLs. (Closes: #922955)
* [CVE-2018-5745]: Avoid assertion and thus causing named to
deliberately exit when a trust anchor's key is replaced with a key
which uses an unsupported algorithm. (Closes: #922954)
-- Bernhard Schmidt <berni(a)debian.org> Fri, 03 May 2019 22:34:35 +0200
--- Modifications pour linux (linux-libc-dev) ---
linux (4.9.168-1+deb9u2) stretch-security; urgency=high
[ Salvatore Bonaccorso ]
* Revert "block/loop: Use global lock for ioctl() operation."
(Closes: #928125)
-- Ben Hutchings <ben(a)decadent.org.uk> Mon, 13 May 2019 21:59:18 +0100
linux (4.9.168-1+deb9u1) stretch-security; urgency=high
* [x86] Update speculation mitigations:
- x86/MCE: Save microcode revision in machine check records
- x86/cpufeatures: Hide AMD-specific speculation flags
- x86/bugs: Add AMD's variant of SSB_NO
- x86/bugs: Add AMD's SPEC_CTRL MSR usage
- x86/bugs: Switch the selection of mitigation from CPU vendor to CPU
features
- x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR
- x86/microcode/intel: Add a helper which gives the microcode revision
- x86/microcode/intel: Check microcode revision before updating sibling
threads
- x86/microcode: Make sure boot_cpu_data.microcode is up-to-date
- x86/microcode: Update the new microcode revision unconditionally
- x86/mm: Use WRITE_ONCE() when setting PTEs
- bitops: avoid integer overflow in GENMASK(_ULL)
- x86/speculation: Simplify the CPU bug detection logic
- locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a
new <linux/bits.h> file
- x86/speculation: Remove SPECTRE_V2_IBRS in enum spectre_v2_mitigation
- x86/cpu: Sanitize FAM6_ATOM naming
- Documentation/l1tf: Fix small spelling typo
- x86/speculation: Apply IBPB more strictly to avoid cross-process data
leak
- x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
- x86/speculation: Propagate information about RSB filling mitigation to
sysfs
- x86/speculation/l1tf: Drop the swap storage limit restriction when
l1tf=off
- x86/speculation: Update the TIF_SSBD comment
- x86/speculation: Clean up spectre_v2_parse_cmdline()
- x86/speculation: Remove unnecessary ret variable in cpu_show_common()
- x86/speculation: Move STIPB/IBPB string conditionals out of
cpu_show_common()
- x86/speculation: Disable STIBP when enhanced IBRS is in use
- x86/speculation: Rename SSBD update functions
- x86/speculation: Reorganize speculation control MSRs update
- x86/Kconfig: Select SCHED_SMT if SMP enabled
- sched: Add sched_smt_active()
- x86/speculation: Rework SMT state change
- x86/l1tf: Show actual SMT state
- x86/speculation: Reorder the spec_v2 code
- x86/speculation: Mark string arrays const correctly
- x86/speculataion: Mark command line parser data __initdata
- x86/speculation: Unify conditional spectre v2 print functions
- x86/speculation: Add command line control for indirect branch speculation
- x86/speculation: Prepare for per task indirect branch speculation control
- x86/process: Consolidate and simplify switch_to_xtra() code
- x86/speculation: Avoid __switch_to_xtra() calls
- x86/speculation: Prepare for conditional IBPB in switch_mm()
- x86/speculation: Split out TIF update
- x86/speculation: Prepare arch_smt_update() for PRCTL mode
- x86/speculation: Prevent stale SPEC_CTRL msr content
- x86/speculation: Add prctl() control for indirect branch speculation
- x86/speculation: Enable prctl mode for spectre_v2_user
- x86/speculation: Add seccomp Spectre v2 user space protection mode
- x86/speculation: Provide IBPB always command line options
- kvm: x86: Report STIBP on GET_SUPPORTED_CPUID
- x86/msr-index: Cleanup bit defines
- x86/speculation: Consolidate CPU whitelists
- Documentation: Move L1TF to separate directory
- cpu/speculation: Add 'mitigations=' cmdline option
- x86/speculation: Support 'mitigations=' cmdline option
- x86/speculation/mds: Add 'mitigations=' support for MDS
- x86/cpu/bugs: Use __initconst for 'const' init data
* [x86] Mitigate Microarchitectural Data Sampling (MDS) vulnerabilities
(CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091):
- x86/speculation/mds: Add basic bug infrastructure for MDS
- x86/speculation/mds: Add BUG_MSBDS_ONLY
- x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
- x86/speculation/mds: Add mds_clear_cpu_buffers()
- x86/speculation/mds: Clear CPU buffers on exit to user
- x86/kvm/vmx: Add MDS protection when L1D Flush is not active
- x86/speculation/mds: Conditionally clear CPU buffers on idle entry
- x86/speculation/mds: Add mitigation control for MDS
- x86/speculation/mds: Add sysfs reporting for MDS
- x86/speculation/mds: Add mitigation mode VMWERV
- Documentation: Add MDS vulnerability documentation
- x86/speculation/mds: Add mds=full,nosmt cmdline option
- x86/speculation: Move arch_smt_update() call to after mitigation decisions
- x86/speculation/mds: Add SMT warning message
- x86/speculation/mds: Fix comment
- x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
- x86/mds: Add MDSUM variant to the MDS documentation
- Documentation: Correct the possible MDS sysfs values
- x86/speculation/mds: Fix documentation typo
* [x86] msr-index: Remove dependency on <linux/bits.h>
* [rt] Update patches to apply on top of the speculation mitigation changes
* [x86] mce, tlb: Ignore ABI changes
-- Ben Hutchings <ben(a)decadent.org.uk> Mon, 13 May 2019 21:51:01 +0100
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on nonagon.federez.net
--
apticron